|Publication number||US20050065941 A1|
|Application number||US 10/842,991|
|Publication date||Mar 24, 2005|
|Filing date||May 11, 2004|
|Priority date||Sep 23, 2003|
|Also published as||WO2005036307A2, WO2005036307A3|
|Publication number||10842991, 842991, US 2005/0065941 A1, US 2005/065941 A1, US 20050065941 A1, US 20050065941A1, US 2005065941 A1, US 2005065941A1, US-A1-20050065941, US-A1-2005065941, US2005/0065941A1, US2005/065941A1, US20050065941 A1, US20050065941A1, US2005065941 A1, US2005065941A1|
|Inventors||Stephen DeAngelis, Frederick Stangl, Doug Todd|
|Original Assignee||Deangelis Stephen F., Stangl Frederick W., Doug Todd|
|Export Citation||BiBTeX, EndNote, RefMan|
|Patent Citations (7), Referenced by (22), Classifications (8), Legal Events (1)|
|External Links: USPTO, USPTO Assignment, Espacenet|
This application claims priority under 35 U.S.C. § 119 to U.S. provisional patent application Ser. No. 60/505,282, filed Sep. 23, 2003.
The present application is related to the following concurrently filed applications:
Embodiments of the present invention are directed generally to methods for optimizing business processes, complying with governmental regulations, and identifying threat and vulnerability risks for an enterprise.
Businesses today face many external pressures. One set of pressures is economic, such as meeting shareholder demands to leverage existing investments to improve performance, thereby increasing the shareholders' investment. Another set of pressures includes compliance with governmental regulations. Over the last several years, a tremendous amount of new laws and regulations have been promulgated, which have created costly and complex compliance requirements for businesses. These new compliance requirements include the U.S. Patriot Act, the Sarbanes-Oxley Act, the Health Insurance Portability and Accountability Act (HIPAA), privacy laws and regulations, and others. Another set of pressures concerns security. Businesses today face both internal and external security concerns, ranging from employee theft of company trade secrets, to denial of service attacks on company web sites, to catastrophic terrorist attacks. A business's ability to address these technological concerns is often exacerbated by the fact that many businesses today use disparate, unconnected information systems.
One known technique for assessing the information security risks of an organization is the OCTAVEŽ (Operationally Critical Threat, Asset, and Vulnerability EvaluationsSM) risk-based strategic assessment and planning technique for security. OCTAVE defines the essential components of a comprehensive, systematic, context-driven information security risk evaluation. By following the OCTAVE risk assessment technique, an organization can make information-protection decisions based on risks to the confidentiality, integrity, and availability of critical information technology assets.
In one general aspect, various embodiments of the present invention are directed to a system, comprising at least one intelligence analytics engine for determining a metric relevant to a business process of an enterprise and a data structure in communication with the intelligence analytics engine. The data structure, according to various embodiments, is for retrieving data from a plurality of data sources as needed by the intelligence analytics engine. In addition, the system may include at least one output device in communication with the intelligence analytics engine for displaying the metric relevant to the business process of the enterprise.
According to other embodiments, the system may include at least one process management engine for executing and monitoring a business process of the enterprise. The process management engine is in communication with the data structure. The data structure may be for retrieving data from the data sources as needed by the process management engine.
According to various implementations, the system may further comprise a collaboration technology engine in communication with the data structure. Additionally, the system may also comprise a security and counter-terrorism services engine in communication with the data structure. The security and counter-terrorism services engine may perform link and predictive analysis on the data in the data sources to identify security and terroristic threats for the enterprise. Further, the data structure may be manifested as a zero-latent universal data model.
Embodiments of the present invention are described herein by example in conjunction with the following figures, wherein:
With reference to
Having identified the key business processes at block 12, the method, according to various embodiments, includes a technological assessment branch, a business process interdependency analysis branch, and a business assessment branch. On the technological assessment branch, the process advances to block 14, where key technological components related to the key business process identified at block 12 are identified. More details regarding the process for identifying key technological components are provided below in connection with
On the business process interdependency analysis branch, the process advances to block 17, where an interdependency matrix of the various business processes identified at block 12 is created. The purpose of this analysis is to detect vulnerabilities in process flow by identifying non-compliant, unsecured, suboptimal and/or conflicted links between the business processes of the enterprise by showing, for example, where processes of the enterprise intersect. More details about the process for generating the interdependency matrix are provided below in conjunction with
On the business assessment branch, the process advances from block 12 to block 18, where areas of concern related to the business process identified at block 12 are identified. These areas may include, for example, compliance issues (block 20), data/information issues (block 22), systems issues (block 24), business processes (block 26), and people issues (block 28). Continuing with the banking example, therefore, the compliance issues may include meeting regulatory compliance requirements with respect to the intake of new customer, such as Office of Foreign Assets Control (OFAC) regulations, privacy regulations, U.S. Patriot Act requirements, the Bank Secrecy Act, other banking regulations, etc. Additional details regarding the identification of areas of concern for the identified key business processes are described below in connection with
Based on the identified areas of concern, the threat profiles for the enterprise related to the business process are created at block 30. Additional details regarding the process for creating the threat profiles are described below in connection with
On the basis of, for example, the threat profiles on the business assessment branch, the business process interdependency analysis, and the evaluation of the selected components in the technological assessment branch, risk, compliance, and optimization analyses may be performed at block 32. Additional details regarding these analyses are provided below in connection with
Based on the protection/security strategy (block 34), the compliance strategy (block 36) and the optimization strategy (block 38), a master plan related to the business process may be developed at block 40. Included in the master plan may be an action list, which may be executed at block 42. At block 44, monitoring tools to monitor execution of the items on the action list are implemented. This may include the implementation of monitoring processes and tools to monitor compliance with the protection/security strategy, the compliance strategy, and the optimization strategy. Additional details regarding the monitoring process are described in below in connection with
With respect to compliance issues, the process may include determining applicable laws and regulations at block 56, conducting a compliance survey with respect to those laws and regulations at block 60, reviewing compliance policies of the enterprise at block 62, determining current compliance practices at block 64, identifying affected processes at block 66 and determining the current state of a compliance at block 68.
Evaluation of the data/information issues related to the business process may include, for example, determining confidentiality requirements at block 70, determining integrity requirements at block 72, determining availability requirements at block 74, conducting a security survey for the enterprise at block 76, reviewing security policies of the enterprise at block 78, and determining current security practices for the enterprise at block 80.
Evaluation of the systems issues may include, for example, identifying threats from the hardware defects at block 82, identifying threats from software defects at block 84, identifying threats from malicious code and viruses at block 86, identifying threats from utility outages at block 88, identifying threats from loss of network connectivity, such as outages from telecommunications providers or ISPs, at block 90, and identifying threats from fire, flood and other natural disasters at block 92.
Evaluation of the business process issues may include, for example, setting criteria for performance optimization at block 94, identifying process bottlenecks at block 96, identifying process failure points at block 98, selecting key performance indicator (“KPI”) metrics for monitoring at block 100, determining monitoring tools and methods at block 102, and identifying process security requirements at block 104.
Also, evaluation of the people issues may include identifying, at block 106, internal threats from deliberate action, identifying internal threats from accidental action at block 108, identifying external threats from deliberate action at block 110, and identifying external threats from accidental action at block 112.
Based on each of these analyses, e.g., the analyses of compliance issues, data/information issues, systems issues, business process issues and people issues, threat profiles for the business process may be created at block 30.
With regard to the performance optimization analysis, the method may include evaluating process design at block 124. Next at block 126, an evaluation of denial of service impacts may be undertaken. At block 128, degradation of service impacts may be evaluated. At block 130, sub-optimal performance risks may be identified. The results from the security/compliance analysis and the performance optimization analysis are used in the performance of the risk, compliance, and optimization analysis (see block 32,
In addition, the process may include evaluating results in operational practice areas, at block 228. The operational practice areas may include, for example, physical security 230, IT security 232, and staff security 234. Based on results from the evaluation of the operational practice areas, and operational protection strategy may be created at block 236.
At block 238, a risk mitigation plan may then be created based on the strategic protection strategy created at block 226 and the operational protection strategy created at block 236. Based on the risk mitigation plan, an action list of near-term solutions may be created at block 240. From the action list of near-term solutions, the master plan may be developed (see block 40,
In addition, the method may include evaluating the results from the compliance analysis 32 in operational practice areas at block 258. The operational practice areas may include, for example, physical accessibility 260, data accessibility 262 and personnel issues 264. Based on the results in these operational practice areas, an operational compliance strategy may be created at block 266.
At block 267, a risk mitigation plan for compliance issues may be created based on the strategic compliance strategy at block 256 and the operational compliance strategy at block 266. Based on the risk mitigation plan, an action list of near-term solutions may be created at block 268. This information may be used in the development of the master plan 40 (see
In addition, the method may include evaluating the results from the optimization analysis 32 in operational practice areas related to business process optimization. The operational practice areas may include, for example, hardware components 288, software components 290, and manual processes 292. Based on the evaluation results in these operational practice areas, an operational optimization strategy may be created at block 294.
The method may further include, at block 296, the creation of a performance optimization plan based on the strategic optimization strategy at block 284 and the operational optimization strategy at block 294. From the performance optimization plan, an action list of near-term solutions may be created at block 298. This information may be used in the development of the master plan at block 40 (see
As illustrated in
The data structure 360 may retrieve data, including metadata, from the data sources 362-372 as needed in the performance by the system 350, such as for the optimization, compliance and security analyses and implementation routines described above. Metadata is data about data. Some of the retrieved data may be persisted in the data structure 360 and some retrieved data may not be persisted, residing instead in the data structure 360 on only a temporary basis. Data in the data structure 360 and its relationship to other data may be defined according to, for example, a data description language (DDL). In addition, according to various embodiments, all of the data from the data sources may be accessible in XML. The data structure 360 may manifest itself, for example, as a federated database and/or a virtual data aggregation layer.
The system 350 may include a number of engines in communication with the data structure 350. The engines may assist in the compliance, optimization, and/or security processes described above in conjunction with
The engines 380, 382, 384, 386 may be implemented as software code to be executed by a processor(s) (not shown) of the system 350 using any type of computer instruction type suitable, such as, for example, Java, C, C++, Visual Basic, etc., using, for example, conventional or object-oriented techniques. The software code may be stored as a series of instructions or commands on a computer readable medium, such as a random access memory (RAM), a read only memory (ROM), a magnetic medium such as a hard drive or a floppy disk, or an optical medium such as a CD-ROM.
The system 350 may also include, as illustrated in
The intelligence analytics engines 380 may analyze enterprise data, on an ongoing and continual basis, to determine parameters and business metrics relevant to the enterprise. For example, the intelligence analytics engines 380 may determine, on an ongoing basis, whether certain performance requirements for business processes of the enterprise, such as determined by the optimization strategy 38 (see
The process management engines 382 may use, for example, Business Process Management (BPM) technology. BPM is a knowledge-based process management technology that executes and monitors repeatable business processes that have been defined by a set of formal procedures. For example, the process management engines 382 may, for example, on an ongoing and continual basis, execute and monitor various business processes of the enterprise that have been defined to satisfy the master plan for the process (see
In addition, the process management engines 382 may employ business process integration (BPI). BPI is the automated operation of a straight-through business process across multiple applications, typically focused on the exchange and update of information and the elimination of manual intervention (with its attendant cost and inaccuracy). BPI systems are based on real-time interactions via the Internet and are not limited to batch processing cycles, unlike EDI. The process management engines 382 may be programmed in, for example, Business Process Execution Language (BPEL), which defines a notation for specifying business process behavior. Further, one or more of the intelligence analytics engines 380 may use data from the process management engines 382 and one or more of the process management engines 382 may utilize data from the intelligence analytics engines.
The collaboration technology engine 384 may, for example, gather and arrange critical, time sensitive enterprise data for presentation to those users that need to disseminate that data immediately or promptly.
The security and counter-terrorism services engine 386 may, for example, provide link analysis and/or predictive analysis on the data in the data sources to identify potential security or terroristic threats. When a potential security or terroristic threat is identified, that information may be communicated via one or more of the output devices 400.
While several embodiments of the present invention have been described herein, it should be apparent that various modifications, alterations and adaptations to those embodiments may occur to persons skilled in the art. For example, various steps in the process flows of
|Cited Patent||Filing date||Publication date||Applicant||Title|
|US6854088 *||Apr 4, 2001||Feb 8, 2005||Spinoza Technology, Inc.||Graphical user interface for project data|
|US6925443 *||Apr 26, 2000||Aug 2, 2005||Safeoperations, Inc.||Method, system and computer program product for assessing information security|
|US6993448 *||Apr 2, 2001||Jan 31, 2006||Telos Corporation||System, method and medium for certifying and accrediting requirements compliance|
|US20020099578 *||Jan 22, 2001||Jul 25, 2002||Eicher Daryl E.||Performance-based supply chain management system and method with automatic alert threshold determination|
|US20030009355 *||Mar 20, 2002||Jan 9, 2003||Gupta Amit K.||System and method for management of health care services|
|US20030084053 *||Nov 1, 2001||May 1, 2003||Actimize Ltd.||System and method for analyzing and utilizing data, by executing complex analytical models in real time|
|US20030110249 *||Jun 8, 2001||Jun 12, 2003||Bryan Buus||System and method for monitoring key performance indicators in a business|
|Citing Patent||Filing date||Publication date||Applicant||Title|
|US7523135 *||Oct 20, 2005||Apr 21, 2009||International Business Machines Corporation||Risk and compliance framework|
|US7533057||Apr 11, 2007||May 12, 2009||Fannie Mae||Servicer compensation system and method|
|US7667582||Oct 14, 2005||Feb 23, 2010||Sun Microsystems, Inc.||Tool for creating charts|
|US7797213||Apr 11, 2007||Sep 14, 2010||Fannie Mae||Cash flow aggregation system and method|
|US7849048||Jul 5, 2005||Dec 7, 2010||Clarabridge, Inc.||System and method of making unstructured data available to structured data analysis tools|
|US7849049||Jul 5, 2005||Dec 7, 2010||Clarabridge, Inc.||Schema and ETL tools for structured and unstructured data|
|US7856397||Dec 29, 2003||Dec 21, 2010||Fannie Mae||System and method for creating financial assets|
|US7885891||Feb 5, 2008||Feb 8, 2011||Fannie Mae||Portal tool and method for securitizing excess servicing fees|
|US7949675 *||May 10, 2005||May 24, 2011||Oracle International Corporation||Data retrieval method|
|US7974681||Jul 6, 2005||Jul 5, 2011||Hansen Medical, Inc.||Robotic catheter system|
|US7987234 *||Oct 14, 2005||Jul 26, 2011||Oracle America, Inc.||Monitoring alert conditions|
|US8214906 *||Oct 21, 2003||Jul 3, 2012||International Business Machines Corporation||System, method and program product to determine security risk of an application|
|US8275644 *||Apr 16, 2008||Sep 25, 2012||International Business Machines Corporation||Generating an optimized analytical business transformation|
|US8285636||Aug 10, 2006||Oct 9, 2012||Curry Edith L||Methods of monitoring behavior/activity of an individual associated with an organization|
|US8666884||Sep 5, 2012||Mar 4, 2014||Edith L. CURRY||Methods of monitoring behavior/activity of an individual associated with an organization|
|US8694532 *||Sep 19, 2005||Apr 8, 2014||First American Data Co., Llc||Method and system for query transformation for managing information from multiple datasets|
|US20040153384 *||Dec 29, 2003||Aug 5, 2004||Fannie Mae||System and method for creating financial assets|
|US20050086530 *||Oct 21, 2003||Apr 21, 2005||International Business Machines Corp.||System, method and program product to determine security risk of an application|
|US20060080313 *||Sep 19, 2005||Apr 13, 2006||Adriano Freire||Midware system 10 and method|
|US20090263768 *||Oct 22, 2009||International Business Machines Corporation||Generating An Optimized Analytical Business Transformation|
|US20110161132 *||Mar 4, 2010||Jun 30, 2011||Sukriti Goel||Method and system for extracting process sequences|
|WO2012030573A1 *||Aug 22, 2011||Mar 8, 2012||Connectiva Systems Inc.||System and method for an auto-configurable architecture for managing business operations favoring optimizing hardware resources|
|U.S. Classification||1/1, 707/999.1|
|International Classification||G06Q40/00, G06Q10/00|
|Cooperative Classification||G06Q10/10, G06Q40/08|
|European Classification||G06Q10/10, G06Q40/08|
|Sep 13, 2004||AS||Assignment|
Owner name: ENTERRA SOLUTIONS, LLC, PENNSYLVANIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:DEANGELIS, STEPHEN F.;STANGL, FREDERICK W.;TODD, DOUG;REEL/FRAME:015769/0889
Effective date: 20040802